21–30 of 82 posts
Is there a good reason for making NPM profile emails public? I have an unique email address on NPM, and it receives a considerable amount of phishing emails that target NPM and Mailgun.
A tangential issue related to this since Github is involved: Github pages. If you point a DNS entry to a Github page and then delete the page without deleting the entry on you DNS table someone can create a new page with the same name and hijack your DNS entry for malicious purposes. I've written to Github already about this, if they want to let you point your DNS to the page they should give you a unique entry to po…
What about checking the whois expiration of every email domain and locking out all the expired ones?
A tangential issue related to this since Github is involved: Github pages. If you point a DNS entry to a Github page and then delete the page without deleting the entry on you DNS table someone can create a new page with the same name and hijack your DNS entry for malicious purposes. I've written to Github already about this, if they want to let you point your DNS to the page they should give you a unique entry to po…
If you point a dns entry to an ip and later someone takes control of that ip, guess what happens... This is a YOU problem, not a GitHub problem. Talking about dilettantes in the tech world...
A tangential issue related to this since Github is involved: Github pages. If you point a DNS entry to a Github page and then delete the page without deleting the entry on you DNS table someone can create a new page with the same name and hijack your DNS entry for malicious purposes. I've written to Github already about this, if they want to let you point your DNS to the page they should give you a unique entry to po…
If you point a dns entry to an ip and later someone takes control of that ip, guess what happens... This is a YOU problem, not a GitHub problem. Talking about dilettantes in the tech world...
All actors should take care of security, you should expect people to make mistakes especially if you're as big as Github. Your take on security is like talking about law and justice with a cowboy.
Is there a good reason for making NPM profile emails public? I have an unique email address on NPM, and it receives a considerable amount of phishing emails that target NPM and Mailgun.
Maybe, having email allows other people to contact if there is any vulnerability etc.? Not all project are on GitHub and there should be someway to contact the author, right?
A tangential issue related to this since Github is involved: Github pages. If you point a DNS entry to a Github page and then delete the page without deleting the entry on you DNS table someone can create a new page with the same name and hijack your DNS entry for malicious purposes. I've written to Github already about this, if they want to let you point your DNS to the page they should give you a unique entry to po…
If you point a dns entry to an ip and later someone takes control of that ip, guess what happens... This is a YOU problem, not a GitHub problem. Talking about dilettantes in the tech world...
A tangential issue related to this since Github is involved: Github pages. If you point a DNS entry to a Github page and then delete the page without deleting the entry on you DNS table someone can create a new page with the same name and hijack your DNS entry for malicious purposes. I've written to Github already about this, if they want to let you point your DNS to the page they should give you a unique entry to po…
Earlier quoted context omitted.
If you point a dns entry to an ip and later someone takes control of that ip, guess what happens... This is a YOU problem, not a GitHub problem. Talking about dilettantes in the tech world...
Yes, and what the parent post was suggesting was that GitHub would have you use a CNAME to point your DNS entry to a unique FQDN (that it can tie back to your specific repo) instead of an IP, which would centrally prevent this issue without relying upon every single user to act perfectly.
Is there a good reason for making NPM profile emails public? I have an unique email address on NPM, and it receives a considerable amount of phishing emails that target NPM and Mailgun.
Maybe, having email allows other people to contact if there is any vulnerability etc.? Not all project are on GitHub and there should be someway to contact the author, right?